diff options
| author | David Jeffery <[email protected]> | 2009-09-28 17:54:24 +0000 |
|---|---|---|
| committer | James Bottomley <[email protected]> | 2009-10-02 19:11:58 +0000 |
| commit | 2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9 (patch) | |
| tree | 890fd3916878e2427141d6e53dd70150ac7ff93e /lib/fault-inject.c | |
| parent | [SCSI] be2iscsi: Moving to pci_pools v3 (diff) | |
| download | kernel-2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9.tar.gz kernel-2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9.zip | |
[SCSI] st: fix possible memory use after free after MTSETBLK ioctl
A memory use after free bug can manifest if the MTSETBLK or SET_DENS_AND_BLK
ioctl features are used to set the tape's blocksize from 0 to non-zero.
After the driver sets the new block size, in this one case it calls
normalize_buffer() to free the device's internal data buffers. However, the
ioctl code assumes there is always a buffer and does not check or allocate
a buffer if there isn't one. So any following ioctl calls can corrupt
a part of memory by writing data to memory that the st driver had freed.
This patch removes the normalize_buffer() call and the specialness of
changing from a 0 to non-zero blocksize to fix the possible use of
memory after it has been freed by the st driver.
signed-off-by: David Jeffery <[email protected]>
Acked-by: Kai Makisara <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Diffstat (limited to 'lib/fault-inject.c')
0 files changed, 0 insertions, 0 deletions